4

For years I have been using GPOs to install MSIs to our Windows clients. All MSIs resided under a single \\fileserver\share, with a GPO assigned to each MSI for installation. Currently, out AD servers are Windows Server 2019 systems (DFS-R for replication).

Since we have a number of remote offices that had had local AD servers, I was wondering whether it would be better to change my approach: throw each MSI into the GPOs special directory, in order for it to replicate to the other AD servers (if I understand correctly this is not "DFS namespaces", whatever that is). This way I'd avoid overloading the network connections of each branch office, since instead of having the same MSI being downloaded for each client in the branch, the client would get the package directly from the local AD server. The handicap here is that I would burden the AD replication with having to include some rather large packages (LibreOffice for example at half a gig).

Is using the AD builtin replication functionlity for this purpose a viable approach, or is it discouraged for some technical reason?

carmik
  • 149
  • 11

2 Answers2

4

Generally, SYSVOL should be avoided as a file share for deployments. The share is required for AD to function, and combining it with other uses can lead to situations where there is an outage.

Exceptions may include the installer for your Configuration Management solution or RMM tool to provide minimal management functionality when an endpoint is brought online.

Separate file server is preferred.

Greg Askew
  • 35,880
  • 5
  • 54
  • 82
2

I use the NETLOGON share for deploying software and personally don't see a problem with doing that.

If replication traffic is a concern, dump your installers there after hours. Half a gig is miniscule.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172